Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in autotel-edge (npm) MAL-2026-5220 | Malicious | Not scored | 05 Jun, 2026 | npm autotel-edge |
Malicious release: Malicious code in effect-analyzer (npm) MAL-2026-5245 | Malicious | Not scored | 05 Jun, 2026 | npm effect-analyzer |
Malicious release: Malicious code in eslint-plugin-awaitly (npm) MAL-2026-5246 | Malicious | Not scored | 05 Jun, 2026 | npm eslint-plugin-awaitly |
Malicious release: Malicious code in eslint-plugin-executable-stories-jest (npm) MAL-2026-5247 | Malicious | Not scored | 05 Jun, 2026 | npm eslint-plugin-executable-stories-jest |
Malicious release: Malicious code in eslint-plugin-executable-stories-vitest (npm) MAL-2026-5249 | Malicious | Not scored | 05 Jun, 2026 | npm eslint-plugin-executable-stories-vitest |
Malicious release: Malicious code in executable-stories-cypress (npm) MAL-2026-5250 | Malicious | Not scored | 05 Jun, 2026 | npm executable-stories-cypress |
Malicious release: Malicious code in executable-stories-demo (npm) MAL-2026-5251 | Malicious | Not scored | 05 Jun, 2026 | npm executable-stories-demo |
Malicious release: Malicious code in executable-stories-formatters (npm) MAL-2026-5252 | Malicious | Not scored | 05 Jun, 2026 | npm executable-stories-formatters |
Malicious release: Malicious code in executable-stories-init (npm) MAL-2026-5253 | Malicious | Not scored | 05 Jun, 2026 | npm executable-stories-init |
Malicious release: Malicious code in executable-stories-jest (npm) MAL-2026-5254 | Malicious | Not scored | 05 Jun, 2026 | npm executable-stories-jest |
Malicious release: Malicious code in executable-stories-mcp (npm) MAL-2026-5255 | Malicious | Not scored | 05 Jun, 2026 | npm executable-stories-mcp |
Malicious release: Malicious code in executable-stories-react (npm) MAL-2026-5257 | Malicious | Not scored | 05 Jun, 2026 | npm executable-stories-react |
Malicious release: Malicious code in mountly-tailwind (npm) MAL-2026-5261 | Malicious | Not scored | 05 Jun, 2026 | npm mountly-tailwind |
Malicious release: Malicious code in node-env-resolver (npm) MAL-2026-5262 | Malicious | Not scored | 05 Jun, 2026 | npm node-env-resolver |
Malicious release: Malicious code in node-env-resolver-aws (npm) MAL-2026-5263 | Malicious | Not scored | 05 Jun, 2026 | npm node-env-resolver-aws |
Malicious release: Malicious code in node-env-resolver-dotenvx (npm) MAL-2026-5264 | Malicious | Not scored | 05 Jun, 2026 | npm node-env-resolver-dotenvx |
Malicious release: Malicious code in node-env-resolver-nextjs (npm) MAL-2026-5265 | Malicious | Not scored | 05 Jun, 2026 | npm node-env-resolver-nextjs |
Malicious release: Malicious code in node-env-resolver-vite (npm) MAL-2026-5266 | Malicious | Not scored | 05 Jun, 2026 | npm node-env-resolver-vite |
Malicious release: Malicious code in wrangler-deploy (npm) GHSA-5vmf-xjrj-jqhh, MAL-2026-5267 | Malicious | Not scored | 05 Jun, 2026 | npm wrangler-deploy |
Malicious release: Malicious code in hbsig (npm) GHSA-6fwm-7v73-876j, MAL-2026-5190 | Malicious | Not scored | 04 Jun, 2026 | npm hbsig |
Malicious release: Malicious code in weavedb-contracts (npm) GHSA-gg4x-c8wr-53p9, MAL-2026-5192 | Malicious | Not scored | 04 Jun, 2026 | npm weavedb-contracts |
Malicious release: Malicious code in arjson (npm) MAL-2026-5189 | Malicious | Not scored | 04 Jun, 2026 | npm arjson |
Malicious release: Malicious code in wdb-core (npm) MAL-2026-5191 | Malicious | Not scored | 04 Jun, 2026 | npm wdb-core |
Malicious release: Malicious code in javascript-yaml (npm) MAL-2026-5193 | Malicious | Not scored | 04 Jun, 2026 | npm javascript-yaml |
Malicious release: Malicious code in yaml-javascript (npm) MAL-2026-5194 | Malicious | Not scored | 04 Jun, 2026 | npm yaml-javascript |
Malicious release: Malicious code in hello244a (npm) GHSA-fv97-hqvh-jxcm, MAL-2026-5188 | Malicious | Not scored | 04 Jun, 2026 | npm hello244a |
Supply chain compromise via malicious @cap-js/openapi GHSA-jpvj-wpmj-h7rv | Critical | Not scored | 04 Jun, 2026 | npm @cap-js/openapi |
Malicious release: Malicious code in autotel-terminal (npm) GHSA-cw9v-v9rh-r449, MAL-2026-5186 | Malicious | Not scored | 04 Jun, 2026 | npm autotel-terminal |
Malicious release: Malicious code in @jagreehal/workflow (npm) GHSA-6w7v-23mf-65g3, MAL-2026-5185 | Malicious | Not scored | 04 Jun, 2026 | npm @jagreehal/workflow |
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending CVE-2026-45337, GHSA-cq3f-vc6p-68fh | High | 0.2% | 04 Jun, 2026 | npm better-auth |
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVE-2026-44496, GHSA-hfxv-24rg-xrqf | High | 5.4% | 04 Jun, 2026 | npm axios |
Allocation of Resources Without Limits or Throttling in Axios CVE-2026-44488, GHSA-777c-7fjr-54vf | High | 0.7% | 04 Jun, 2026 | npm axios |
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter CVE-2026-44487, GHSA-p92q-9vqr-4j8v | High | 0.7% | 04 Jun, 2026 | npm axios |
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection CVE-2026-44486, GHSA-j5f8-grm9-p9fc | High | 0.6% | 04 Jun, 2026 | npm axios |
Keystone: GraphQL API Endpoint Lacks Query Depth Limits CVE-2026-10802, GHSA-45jq-c8xm-jfw9 | Low | 0.3% | 04 Jun, 2026 | npm @keystone-6/core |
Malicious release: Malicious code in cms-store-ren (npm) MAL-2026-5364 | Malicious | Not scored | 04 Jun, 2026 | npm cms-store-ren |
Malicious release: Malicious code in nodemon-webpatch (npm) GHSA-q398-93fh-ghmj, MAL-2026-5180 | Malicious | Not scored | 03 Jun, 2026 | npm nodemon-webpatch |
Malicious release: Malicious code in chai-midpatch (npm) GHSA-qq87-jvv3-6c7r, MAL-2026-5179 | Malicious | Not scored | 03 Jun, 2026 | npm chai-midpatch |
Malicious release: Malicious code in webpack-json (npm) GHSA-69hx-wrc9-h5wq, MAL-2026-5175 | Malicious | Not scored | 03 Jun, 2026 | npm webpack-json |
Malicious release: Malicious code in nodemon-pack (npm) GHSA-pqxq-jw84-3x8f, MAL-2026-5174 | Malicious | Not scored | 03 Jun, 2026 | npm nodemon-pack |
Malicious release: Malicious code in brave-search-mcp-server (npm) MAL-2026-5182 | Malicious | Not scored | 03 Jun, 2026 | npm brave-search-mcp-server |
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user CVE-2026-5078, GHSA-4vj7-5mj6-jm8m | Medium | 0.3% | 03 Jun, 2026 | npm morgan |
DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption CVE-2026-10691, GHSA-r87g-78mx-3wg4 | Low | 0.4% | 03 Jun, 2026 | npm @wonderwhy-er/desktop-commander |
DesktopCommanderMCP is vulnerable to SSRF CVE-2026-10690, GHSA-5xx3-j724-wmx5 | Low | 0.2% | 03 Jun, 2026 | npm @wonderwhy-er/desktop-commander |
browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server CVE-2026-49144, GHSA-8rpw-6cqh-2v9h | High | 0.4% | 02 Jun, 2026 | npm browserstack-runner |
browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler CVE-2026-49143, GHSA-6vr3-7wcx-v5g5 | High | 0.8% | 02 Jun, 2026 | npm browserstack-runner |
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint CVE-2026-42342, GHSA-8x6r-g9mw-2r78 | High | 0.3% | 02 Jun, 2026 | npm @remix-run/server-runtime npm react-router |
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE CVE-2026-42211, GHSA-49rj-9fvp-4h2h | High | 0.4% | 02 Jun, 2026 | npm react-router |
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation CVE-2026-40181, GHSA-2j2x-hqr9-3h42 | Medium | 0.2% | 02 Jun, 2026 | npm @remix-run/router npm react-router |
React Router vulnerable to Denial of Service via reflected user input in single-fetch CVE-2026-34077, GHSA-rxv8-25v2-qmq8 | High | 0.3% | 02 Jun, 2026 | npm react-router npm turbo-stream |